OCI Gen2 EPM - How to setup Identity Policy to only manage access (user/role/assignments/AppRole)

Summary:

We were migrated to OCI Gen2 EPM in last wave and are trying to fix our Access Setup, and wish to setup a restricted access Group in default Identity domain.

Content (please ensure you mask any confidential information):

We wish to setup a Group with proper Identity Policy which ensures those users can only manage users and groups, assign users to groups, and assign users/groups to App Roles under various Application listed in Oracle Cloud Instances.

Version (include the version you are using, if applicable):

OCI Gen2

Code Snippet (add any code snippets that support your topic, if applicable):